Make NSSCertDatabase::ListCerts work async on a worker thread.

net/cert/nss_cert_database.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/nss_cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
+#include "base/bind.h"
+#include "base/callback.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/observer_list_threadsafe.h"
+#include "base/task_runner.h"
+#include "base/threading/worker_pool.h"
 #include "crypto/nss_util.h"
 #include "crypto/nss_util_internal.h"
 #include "crypto/scoped_nss_types.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_database.h"
 #include "net/cert/x509_certificate.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
 
 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use
 // the new name of the macro.
 #if !defined(CERTDB_TERMINAL_RECORD)
 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER
 #endif
 
 // PSM = Mozilla's Personal Security Manager.
 namespace psm = mozilla_security_manager;
 
 namespace net {
 
 namespace {
 
 base::LazyInstance<NSSCertDatabase>::Leaky
     g_nss_cert_database = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
-
 NSSCertDatabase::ImportCertFailure::ImportCertFailure(
     const scoped_refptr<X509Certificate>& cert,
     int err)
     : certificate(cert), net_error(err) {}
 
 NSSCertDatabase::ImportCertFailure::~ImportCertFailure() {}
 
 // static
 NSSCertDatabase* NSSCertDatabase::GetInstance() {
   // TODO(mattm): Remove this ifdef guard once the linux impl of
   // GetNSSCertDatabaseForResourceContext does not call GetInstance.
 #if defined(OS_CHROMEOS)
   LOG(ERROR) << "NSSCertDatabase::GetInstance() is deprecated."
              << "See http://crbug.com/329735.";
 #endif
   return &g_nss_cert_database.Get();
 }
 
 NSSCertDatabase::NSSCertDatabase()
     : observer_list_(new ObserverListThreadSafe<Observer>) {
   // This also makes sure that NSS has been initialized.
   CertDatabase::GetInstance()->ObserveNSSCertDatabase(this);
 
   psm::EnsurePKCS12Init();
 }
 
 NSSCertDatabase::~NSSCertDatabase() {}
 
-void NSSCertDatabase::ListCerts(CertificateList* certs) {
+void NSSCertDatabase::ListCertsSync(CertificateList* certs) {
   certs->clear();
 
   CERTCertList* cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
   CERTCertListNode* node;
   for (node = CERT_LIST_HEAD(cert_list);
        !CERT_LIST_END(node, cert_list);
        node = CERT_LIST_NEXT(node)) {
     certs->push_back(X509Certificate::CreateFromHandle(
         node->cert, X509Certificate::OSCertHandles()));
   }
   CERT_DestroyCertList(cert_list);
 }
 
+void NSSCertDatabase::ListCerts(
+    const base::Callback<void(scoped_ptr<CertificateList> certs)>& callback) {
+  scoped_ptr<CertificateList> certs(new CertificateList());
+  CertificateList* raw_certs = certs.get();
+
+  scoped_ptr<NSSDatabaseFilter::CertNotAllowedPredicate> predicate;
+
+  scoped_refptr<NSSDatabaseFilter> database_filter = GetDatabaseFilter();
+  if (database_filter)
+    predicate.reset(new NSSDatabaseFilter::CertNotAllowedPredicate(
+        database_filter));
+
+  GetSlowTaskRunner()->PostTaskAndReply(
+      FROM_HERE,
+      base::Bind(&NSSCertDatabase::ListAndFilterCerts,
+                 base::Passed(&predicate),
+                 base::Unretained(raw_certs)),
+      base::Bind(callback, base::Passed(&certs)));
+}
+
 crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
   return crypto::ScopedPK11Slot(crypto::GetPublicNSSKeySlot());
 }
 
 crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
   return crypto::ScopedPK11Slot(crypto::GetPrivateNSSKeySlot());
 }
 
 CryptoModule* NSSCertDatabase::GetPublicModule() const {
   crypto::ScopedPK11Slot slot(GetPublicSlot());
   return CryptoModule::CreateFromHandle(slot.get());
 }
 
 CryptoModule* NSSCertDatabase::GetPrivateModule() const {
   crypto::ScopedPK11Slot slot(GetPrivateSlot());
   return CryptoModule::CreateFromHandle(slot.get());
 }
 
-void NSSCertDatabase::ListModules(CryptoModuleList* modules,
-                                  bool need_rw) const {
+void NSSCertDatabase::ListModulesSync(CryptoModuleList* modules,
+                                      bool need_rw) const {
   modules->clear();
 
   // The wincx arg is unused since we don't call PK11_SetIsLoggedInFunc.
   crypto::ScopedPK11SlotList slot_list(
       PK11_GetAllTokens(CKM_INVALID_MECHANISM,
                         need_rw ? PR_TRUE : PR_FALSE,  // needRW
                         PR_TRUE,                       // loadCerts (unused)
                         NULL));                        // wincx
   if (!slot_list) {
     LOG(ERROR) << "PK11_GetAllTokens failed: " << PORT_GetError();
@@ skipping 225 matching lines @@
 }
 
 void NSSCertDatabase::AddObserver(Observer* observer) {
   observer_list_->AddObserver(observer);
 }
 
 void NSSCertDatabase::RemoveObserver(Observer* observer) {
   observer_list_->RemoveObserver(observer);
 }
 
+void NSSCertDatabase::SetSlowTaskRunnerForTest(
+    const scoped_refptr<base::TaskRunner>& task_runner) {
+  slow_task_runner_for_test_ = task_runner;
+}
+
+// static
+void NSSCertDatabase::ListAndFilterCerts(
+    scoped_ptr<NSSDatabaseFilter::CertNotAllowedPredicate> predicate,
+    CertificateList* certs) {
+  CHECK(certs);
+  certs->clear();
+
+  CERTCertList* cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
+  CERTCertListNode* node;
+  for (node = CERT_LIST_HEAD(cert_list);
+       !CERT_LIST_END(node, cert_list);
+       node = CERT_LIST_NEXT(node)) {
+    certs->push_back(X509Certificate::CreateFromHandle(
+        node->cert, X509Certificate::OSCertHandles()));
+  }
+  CERT_DestroyCertList(cert_list);
+
+  // No certificate filter was set.
+  if (!predicate)
+    return;
+
+  size_t pre_size = certs->size();
+  certs->erase(std::remove_if(certs->begin(), certs->end(), *predicate),
+               certs->end());
+  DVLOG(1) << "filtered " << pre_size - certs->size() << " of " << pre_size
+           << " certs";
+}
+
 void NSSCertDatabase::NotifyObserversOfCertAdded(const X509Certificate* cert) {
   observer_list_->Notify(&Observer::OnCertAdded, make_scoped_refptr(cert));
 }
 
 void NSSCertDatabase::NotifyObserversOfCertRemoved(
     const X509Certificate* cert) {
   observer_list_->Notify(&Observer::OnCertRemoved, make_scoped_refptr(cert));
 }
 
 void NSSCertDatabase::NotifyObserversOfCACertChanged(
     const X509Certificate* cert) {
   observer_list_->Notify(
       &Observer::OnCACertChanged, make_scoped_refptr(cert));
 }
 
+scoped_refptr<NSSDatabaseFilter> NSSCertDatabase::GetDatabaseFilter() const {
+  return NULL;
+}
+
+scoped_refptr<base::TaskRunner> NSSCertDatabase::GetSlowTaskRunner() const {
+  if (slow_task_runner_for_test_)
+    return slow_task_runner_for_test_;
+  return base::WorkerPool::GetTaskRunner(true /*task is slow*/);
+}
+
 }  // namespace net